BLUEPINKSECURITY INC. / PUBLIC LEGAL DOCUMENT

Data Processing Addendum (DPA)

Business-to-business processing under a written customer agreement

1. Application and parties

This Data Processing Addendum (“DPA”) is incorporated into a written agreement or order (“Agreement”) between Bluepinksecurity Inc. (“BPS”) and a customer (“Customer”) only where that Agreement expressly incorporates this DPA. It applies solely to the processing of personal data by BPS on Customer's behalf in connection with services identified in that Agreement (“Customer Personal Data”). This DPA is distinct from BPS's Privacy Policy for the public website and TIAP conversations, under which BPS ordinarily determines the purposes of visitor-data processing.

2. Definitions and roles

“Data Protection Laws” means the privacy and data protection laws applicable to the particular processing, including the EU General Data Protection Regulation, UK GDPR and applicable United States state privacy statutes. “Personal Data Breach,” “Data Subject,” “Controller,” “Processor” and “Subprocessor” have the meanings assigned under the applicable law. Customer ordinarily acts as controller, or as a processor for another controller where disclosed in the Agreement. BPS acts as Customer's processor or service provider for the Customer Personal Data identified in the Agreement. Each party remains responsible for obligations assigned to it by law.

3. Instructions and purpose limitation

BPS shall process Customer Personal Data only for the scope, duration and purposes defined by the Agreement, this DPA and Customer's lawful documented instructions, including instructions necessary to provide and secure the specified services, unless applicable law requires other processing. If legally permitted, BPS shall inform Customer before processing compelled by law. BPS shall promptly inform Customer if an instruction appears to violate applicable Data Protection Laws. BPS shall not sell Customer Personal Data, use it for independent advertising, or train general-purpose models on it absent separately documented authorization and a lawful basis.

4. Confidentiality and personnel

BPS shall ensure that individuals authorized to process Customer Personal Data are bound by appropriate confidentiality duties, receive proportionate training and have access only as necessary for their assigned functions. BPS shall maintain appropriate access authorization and termination procedures.

5. Technical and organizational protection

Considering the state of the art, implementation costs, risks and the nature of the processing, BPS shall maintain the safeguards described in Annex II and any additional service-specific safeguards documented in the Agreement. Measures will address confidentiality, integrity, availability and resilience, risk-based testing, appropriate encryption, access control, incident response, logging and recovery. Additional technical controls may be agreed for customer deployment environments and regulated information.

6. Breach handling

BPS shall notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and, where feasible, within 48 hours of confirmation of the event, unless a stricter period is agreed or required. BPS shall provide information reasonably available about the nature of the incident, categories and approximate numbers involved where known, likely consequences, and measures taken or proposed. BPS may supplement initial information as the investigation develops. Customer retains responsibility for notifications to regulators and individuals where Customer is the controller, with BPS providing assistance as legally required.

7. Subprocessors

Customer grants BPS general authorization to engage subprocessors necessary for the agreed services, subject to the process below. BPS shall maintain a service-specific subprocessor register available through the Agreement or a written notice channel and shall inform Customer of intended material additions or replacements at least 30 calendar days before the new processing begins, where commercially practicable. Customer may object in writing within 15 calendar days on reasonable data protection grounds. The parties shall work to resolve the objection; if resolution is impracticable, Customer may terminate the affected services under the Agreement's applicable terms. BPS shall impose equivalent data protection obligations on subprocessors and remains responsible for their performance as required by law. The public TIAP's voice service is included in a customer engagement only when expressly within that purchased service's scope.

8. Data-subject requests and assistance

BPS shall, taking into account the nature of processing and information available to it, assist Customer in responding to valid requests for access, rectification, erasure, portability, objection and restriction as required by law. Unless legally prohibited, BPS shall direct any relevant request received directly from an individual to Customer. BPS shall also provide reasonable assistance with data protection impact assessments, security obligations and consultations with regulators where required, subject to documented reasonable cost arrangements when legally permitted.

9. International transfers

This DPA is a processor agreement; it does not itself constitute an executed international transfer instrument. Before a restricted transfer, the parties shall identify and implement a lawful mechanism. Where necessary, the parties shall execute or validly incorporate the appropriate module and completed annexes of the European Commission's 2021 Standard Contractual Clauses for international transfers, together with any applicable UK Addendum, UK IDTA or Swiss adaptation, transfer impact assessment and supplementary measures. An adequacy decision or recognized transfer framework may be used only where its current applicability and scope are verified.

10. Audit and information rights

BPS shall provide information reasonably necessary to demonstrate compliance with applicable processor obligations and allow legally required audits or inspections by Customer or an independent qualified auditor. Audits shall preserve the security and confidentiality of other customers and BPS systems, ordinarily with 30 days' advance notice and once per year, without prejudice to additional inspections justified by a significant incident or substantiated non-compliance. Parties may use suitable third-party assurance reports where they provide sufficient evidence. BPS represents an assurance or certification only if independently obtained for the identified scope.

11. Return, deletion and end of service

At the end of the relevant services, BPS shall, at Customer's choice and subject to applicable law, return or delete Customer Personal Data in accordance with the Agreement and documented instructions. BPS shall cease processing except where lawful retention is required. Retained backup copies shall be protected, excluded from routine processing and deleted in the applicable documented lifecycle. BPS shall reasonably confirm completion on request. Service-specific retention and exit assistance details are identified in the Agreement.

12. Customer responsibilities

Customer is responsible for determining appropriate purposes and lawful bases for its data, providing required notices and obtaining relevant permissions, maintaining authorized instructions and configuring any controls assigned to Customer. Customer shall provide special-category data, sensitive regulated information or data about children only where the service scope expressly permits and appropriate safeguards have been agreed.

13. State privacy laws

Where applicable US state privacy statutes define BPS as a service provider, contractor or processor, BPS shall limit use of Customer Personal Data to the specific business purposes in the Agreement and shall refrain from prohibited sales, cross-context sharing, secondary uses or combining datasets, subject to legally applicable exceptions. BPS shall notify Customer if it determines that it can no longer meet material statutory obligations and shall cooperate with reasonable, lawful steps to verify and remediate compliance.

14. Conflict, term and enforceability

This DPA applies for as long as BPS processes Customer Personal Data for the relevant Agreement. Where a conflict concerns protection of Customer Personal Data, this DPA prevails over inconsistent general terms to the extent required by law. Commercial allocation of risk, pricing and other matters are governed by the Agreement, subject to mandatory law. Any international transfer clauses, when separately incorporated, take precedence where they so provide.

Annex I. Description of processing

Subject matter: personal data handled in providing the specific services ordered by Customer. Duration: the service term plus lawful retention and agreed exit periods. Nature: receipt, hosting, transmission, authorized inference or workflow processing, troubleshooting, security, storage and deletion as authorized for the service. Purpose: the documented business purpose and instructions described in the applicable order. Individuals: Customer's authorized users, employees, representatives, customers, suppliers or contacts, as identified for the service. Categories: professional identity, contact details, account and access information, business content and operational data as set out in the order. Sensitive information: excluded unless the order specifically identifies permitted categories and controls. BPS is the processor; Customer and, where applicable, an upstream controller are identified by the executed Agreement. The service order shall supply any details required to make this description specific to the purchased service.

Annex II. Security commitments

Governance: designate accountable security personnel, assess risk, review privileges and enforce confidentiality. Access: least-privilege authorization and strong protection of privileged access. Encryption: protect data in transit and at rest as appropriate to the service and risk, with responsible management of keys and secrets. Engineering: assess third-party dependencies, maintain secure configuration and change control, and remediate vulnerabilities in a risk-prioritized manner. AI and agent systems: bound execution authority, maintain scoped permissions and controls against misuse of connected tools, and require human approval where the applicable risk assessment calls for it. Operations: proportionate logging, detection, escalation, incident response and documented recovery measures. Lifecycle: retention controls, controlled exports, deletion processes and subprocessor oversight. Assurance: maintain reasonable evidence of operating the agreed measures, with any independently issued certification identified by issuer, dates and scope.

Annex III. Subprocessors and transfer details

For each service, BPS shall make available the identity, function and processing location of authorized subprocessors through a register communicated in or under the Agreement. Any customer-specific subprocessor restrictions and update channels shall be recorded in the service order. A recipient outside the relevant protected jurisdiction shall be covered by the transfer mechanism required by Data Protection Laws. This annex does not represent that providers engaged for BPS's public website are automatically subprocessors for Customer's contracted services.

Execution and incorporation

This DPA becomes binding only when incorporated by an Agreement accepted by both parties, or when separately executed by their duly authorized representatives. Bluepinksecurity Inc. and the Customer are identified as the contracting parties in the Agreement. The applicable authorized signatories and method of signature or acceptance are determined under that Agreement. For enquiries or formal data protection notices concerning this DPA, contact dpo@bluepinksecurity.com, subject to any additional notice requirements in the Agreement.

ISSUED BY BLUEPINKSECURITY INC.

Data protection and legal enquiries: dpo@bluepinksecurity.com

Last updated: 18 October 2026